Parent Process Detection

Created the Monday 18 March 2019. Updated 1 year, 2 months ago.

Parent process is a technique used by malware to evade detection by security analysts. The parent process of a given process is the process that spawned it.

For example, most user processes on a Windows system have explorer.exe as their parent process. By checking the parent process of a given process, malware can determine whether it is being monitored by security analysts. If the parent process is not explorer.exe, then the process is likely being monitored and the malware can take evasive action, such as terminating itself.

Technique Identifier

U0404

Technique Tags

Process Spawn Explorer.exe Monitoring Evasive action Termination Encryption

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

Code Snippets

Description

This code uses the CreateToolhelp32Snapshot() and Process32First()/Process32Next() functions to iterate over all processes in the system and find the one with the same ID as the current process. It then checks the parent process ID of the current process, and compares it to 0 (the process ID of explorer.exe), to determine whether the parent process is explorer.exe or not. If the parent process is not explorer.exe, then the process is likely being monitored and the malware can take evasive action.

#include <Windows.h>
#include <TlHelp32.h>
#include <iostream>

int main()
{
    // Get the current process ID
    DWORD currentPID = GetCurrentProcessId();

    // Create a snapshot of all processes in the system
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    // Initialize the process entry structure
    PROCESSENTRY32 entry;
    entry.dwSize = sizeof(entry);

    // Iterate over all processes in the snapshot
    if (Process32First(snapshot, &entry))
    {
        do
        {
            // Check if the current process is the one we're looking for
            if (entry.th32ProcessID == currentPID)
            {
                // The parent process ID is the one we want
                DWORD parentPID = entry.th32ParentProcessID;

                // Check if the parent process is explorer.exe
                if (parentPID == 0)
                {
                    std::cout << "Parent process is explorer.exe" << std::endl;
                }
                else
                {
                    std::cout << "Parent process is not explorer.exe" << std::endl;
                }

                break;
            }
        } while (Process32Next(snapshot, &entry));
    }

    // Clean up
    CloseHandle(snapshot);

    return 0;
}

About Author Open Snippet

Author: Unprotect / Target Platform: Windows

Detection Rules

rule ParentProcessEvasion
{
    strings:
        // Check for the CreateToolhelp32Snapshot() function call
        $create_snapshot = "CreateToolhelp32Snapshot"

        // Check for the Process32First() function call
        $process32_first = "Process32First"

        // Check for the Process32Next() function call
        $process32_next = "Process32Next"

        // Check for the GetCurrentProcessId() function call
        $get_current_pid = "GetCurrentProcessId"

    condition:
        // Check if all the required strings are present in the code
        all of them
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Detecting Malicious Processes Using Psinfo Volatility Plugin - Cysinfo

Matching Samples 10 most recent

Sample Name	Matching Techniques	First Seen	Last Seen
Xulytaikhoan.xlsx	14	2024-11-26	3 weeks, 1 day ago
putty-64bit-0.81-installer.msi	2	2024-11-25	3 weeks, 2 days ago
procexp.exe	6	2024-11-21	3 weeks, 5 days ago
cfcb85ddfe25f093feb249d4004d...064da7e9ed119971859c61817f1f	7	2024-11-19	4 weeks, 1 day ago
57e0cadabe82b0c02a5d4606b0a3...6672d88e5a1ea4651969392c290b	12	2024-11-19	4 weeks, 1 day ago
315194f647f925de53ce6f014d64...9fb23070d253276b626a132557e8	10	2024-11-19	4 weeks, 1 day ago
23b1971659b16e186f9e1b36d8bc...e512b346e78f77dc314503aac59a	13	2024-11-19	4 weeks, 1 day ago
0f52170adf871c6983d7aaa2162a...7b5850a294feaa71dcaffcf661a2	12	2024-11-19	4 weeks, 1 day ago
implant.exe	6	2024-11-18	1 month ago
KnightOnLine.exe	7	2024-11-17	1 month ago

View All